Analysis
-
max time kernel
151s -
max time network
189s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 17:04
Static task
static1
Behavioral task
behavioral1
Sample
f15f83fe041a57ac0c6ef7b35477c4c15a182422122e880052c4e6d6a08ada0e.url
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
f15f83fe041a57ac0c6ef7b35477c4c15a182422122e880052c4e6d6a08ada0e.url
Resource
win10v2004-20220812-en
General
-
Target
f15f83fe041a57ac0c6ef7b35477c4c15a182422122e880052c4e6d6a08ada0e.url
-
Size
47B
-
MD5
189360043dbadb7132eef83aae6df830
-
SHA1
cd026318d1ef4cfbd01786ebf0b46eb508178007
-
SHA256
f15f83fe041a57ac0c6ef7b35477c4c15a182422122e880052c4e6d6a08ada0e
-
SHA512
6dbc8916b5a86deb1e457c2bb719a622e7192888a64dcd6cafd3b23fbbcd1a89e75c52e99e0f5eaa5c07ee26fa8f5a9c02841a4e4d55b94af299b7055be61daa
Malware Config
Signatures
-
Detected phishing page
-
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80afbbae5404d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BF7F10F1-7047-11ED-B110-4EFAD8A2B6A5} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af00000000020000000000106600000001000020000000030325bebf87c1f64ec0b159a8c905d873a1188d94c7523cfbf3eb7fc2bd9830000000000e8000000002000020000000319429435fb7b4f3595da68fe12a28b258b585a41ca1b74546c3a02d0b44caa59000000068fcf7c1a456b15b431a74a507c0e26d58d47aff6aa04278d3931e3d287ed1e6289482cf0868d010b07b5ed2ef3965d77083c1acc96efdc4122029db7a1bb92ed7a4a358bbaf83d3f086529a9c01c00653bbd29c500b9f9564c18f8a41bb8192bb245857aece498f4d546717de4b5e839409d2547f93b92140afa89d531f849b0308b0a789116f6c100075a99403802740000000809fff423d61079ecdad3cd8c400384b78a9de29257b06499b3aa0ae467cb895a81f0e6391e40eb02f1c73739060e1ead281670ca86fc25e34d6668682a73879 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af000000000200000000001066000000010000200000003cf0babf63b48b175cec25bf6a55bbc3fb2ac35ed9ce4b5b6bad6e7c2a23e429000000000e8000000002000020000000efab108f36d77be3c5ed76e63e45b20066db4af03fbe1edfa9f27d6505a54c52200000005bfb5040361d5a6a447fd0c8403498e323bc6587b1510befcc6cad95231b33324000000039282d77789928384fa5fedc550c355ea85ff4b6d41d6d11a54a9516bcce2ea5296e93795b77f2f5c3fd653a62257d62406752bd969bd121a7b14b11eec9ed44 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376533887" iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
IEXPLORE.EXEpid process 1004 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 936 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 936 iexplore.exe 936 iexplore.exe 1004 IEXPLORE.EXE 1004 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 936 wrote to memory of 1004 936 iexplore.exe IEXPLORE.EXE PID 936 wrote to memory of 1004 936 iexplore.exe IEXPLORE.EXE PID 936 wrote to memory of 1004 936 iexplore.exe IEXPLORE.EXE PID 936 wrote to memory of 1004 936 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\f15f83fe041a57ac0c6ef7b35477c4c15a182422122e880052c4e6d6a08ada0e.url1⤵
- Checks whether UAC is enabled
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:936 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\66U3X1E4.txtFilesize
608B
MD531c2c1d28c8f299654009b2253f92b82
SHA1a1086b24a88f384fe4c8248b42badd791c3c8a95
SHA256ffb35e624d5eb8256bbcce2e48175c88e5390177084bf3bec686cd05c5ca36be
SHA512b5947d43e491cb5471e34b1c5f4a2e0bead702b5793c27e356b5a6bd58db5bde9e9f8c1020e21bed3d4cc3d72ed8927d416f629f23a46a47fd0ff1903bc93912
-
memory/2024-54-0x000007FEFC2E1000-0x000007FEFC2E3000-memory.dmpFilesize
8KB
-
memory/2024-55-0x0000000001BD0000-0x0000000001BE0000-memory.dmpFilesize
64KB